New Lace and Arsenic: adventures in weak memory with a program logic

We describe a program logic for weak memory (also known as relaxed memory). The logic is based on Hoare logic within a thread, and rely/guarantee between threads. It is presented via examples, giving proofs of many weak-memory litmus tests. It extends to coherence but not yet to synchronised assignment (compare-and-swap, load-logical/store-conditional). It deals with conditionals and loops but not yet arrays or heap. The logic uses a version of Hoare logic within threads, and a version of rely/guarantee between threads, with five stability rules to handle various kinds of parallelism (external, internal, propagation-free and two kinds of in-flight parallelism). There are B and U modalities to handle propagation, and temporal modalities since, Sofar and Ouat to deal with global coherence (SC per location). The logic is presented by example. Proofs and unproofs of about thirty weak-memory examples, including many litmus tests in various guises, are dealt with in detail. There is a proof of a version of the token ring. A note on authorship This paper reports the joint work of its authors. But the words in the paper were written by Richard Bornat. Any opprobrium, bug reports, complaints, and observations about sins of commission or omission should be directed at him. A note on version 2 The correspondence with Herding Cats has been clarified. The stability rules have been simplified: in particular the sat and x=x̂ tests have been eliminated from external stability checks. The embedding is simplified and has a more transparent relation to the mechanisms of the logic. Definitions of U, Sofar and Ouat have been considerably altered. The description of modalities and the treatment of termination has been reworked. Many proofs are reconstructed. A comprehensive summary of the logic is an appendix. ar X iv :1 51 2. 01 41 6v 2 [ cs .L O ] 4 N ov 2 01 6